In May 2026, cryptocurrency thefts amounted to $68.3 million, marking a significant drop from April’s $650 million losses, according to blockchain security firm CertiK. Despite the reduced figures, the month’s cyberattacks still included major exploits like the $11.5 million breach of the Verus-Ethereum Bridge and a $10.1 million loss from THORChain’s vault exploit. Cross-chain bridges accounted for nearly 42% of these losses, highlighting vulnerabilities in these protocols, while bugs and code weaknesses contributed to about two-thirds of the total amount stolen.

However, these on-chain losses reveal only part of the broader security crisis facing the crypto sector. Off-chain, physical assaults targeting cryptocurrency owners have escalated sharply. Reports show a 75% increase in incidents involving kidnappings, armed home invasions, and coercive thefts, known in security circles as “wrench attacks.” These attacks compel victims to surrender private keys or wallets under threat or physical force, bypassing traditional cyber defenses.

Data from CertiK’s intelligence division indicates that in the first few months of 2026 alone, 34 verified wrench attacks accounted for losses exceeding $100 million globally. This figure comes on top of 72 assaults recorded in 2025, which resulted in $41 million in losses. Experts warn that these numbers are likely conservative because many victims resolve ransom situations privately, keeping details out of public records.

The rise in physical threats has forced the cryptocurrency industry to rethink security strategies, focusing not only on digital safeguards but also on personal safety measures for holders. Increasingly, conferences and community discussions have highlighted the need for comprehensive protection that includes law enforcement collaboration and secure custody solutions to counter the evolving security landscape.

Phishing attacks remain a significant part of crypto crime, with $2.6 million lost in May alone, even as roughly $9.4 million was successfully recovered or returned to victims’ accounts. The combined data underscores the multifaceted risks cryptocurrency users face—from software vulnerabilities to direct physical danger—presenting challenges that purely technological defenses cannot fully address.